From e11b39314ddc7728c4ab416761fa1c27b6c5b106 Mon Sep 17 00:00:00 2001 From: James Antill Date: Mon, 1 Jun 2026 18:38:22 -0400 Subject: [PATCH] nftables: Fix/merge monitoring changes between prod/staging. Signed-off-by: James Antill --- .../base/templates/nftables/_nft_accept_monitoring | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/roles/base/templates/nftables/_nft_accept_monitoring b/roles/base/templates/nftables/_nft_accept_monitoring index b24676659b..0a64adaa07 100644 --- a/roles/base/templates/nftables/_nft_accept_monitoring +++ b/roles/base/templates/nftables/_nft_accept_monitoring @@ -2,14 +2,23 @@ # Default accept policy, let things be monitored # for nrpe - allow it from nocs +# NOTE: These were still here in staging, before the cleanup. #add rule {{_tn}} INPUT ip saddr 192.168.1.10 tcp dport 5666 counter accept #add rule {{_tn}} INPUT ip saddr 192.168.1.166 tcp dport 5666 counter accept +#add rule {{_tn}} INPUT ip saddr 192.168.1.66 tcp dport 5666 counter accept # FIXME - this is the global nat-ip and we need the noc01-specific ip add rule {{_tn}} INPUT ip saddr 38.145.32.16 tcp dport 5666 counter accept add rule {{_tn}} INPUT ip saddr 38.145.32.15 tcp dport 5666 counter accept add rule {{_tn}} INPUT ip saddr 10.16.163.10 tcp dport 5666 counter accept -add rule {{_tn}} INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept +# NOTE: This was in staging only, before the cleanup. But seems dead. +#add rule {{_tn}} INPUT ip saddr 10.16.166.10 tcp dport 5666 counter accept + +{% if env != 'staging' %} # zabbix01 add rule {{_tn}} INPUT tcp dport 10051 counter accept add rule {{_tn}} INPUT ip saddr 10.3.163.198 tcp dport 10050 counter accept - +{% else %} +# zabbix01.stg +add rule ip filter INPUT tcp dport 10051 counter accept +add rule ip filter INPUT ip saddr 10.16.166.61 tcp dport 10050 counter accept +{% endif %}